Get

The easier way to get peaks is to use one of the packaged versions or, if you prefer, to compile it yourself

Docker

docker pull r4yan2/peaks:slim

Snap

Compile

Download the full repository

git clone https://github.com/r4yan2/peaks

Configure

Docker Compose

The easiest way to have an up and running peaks keyserver is to use a docker-compose file. As multiple configuration options are available, it is provided an example configuration that will work on most systems with minimal modifications

version: '3.3'

services:
    db:
      image: mysql:5.7
      volumes:
         - ./peaks_db:/var/lib/mysql:rw
      environment:
         MYSQL_ROOT_PASSWORD: "mysupersuperpassword"
      command: --innodb_buffer_pool_size=1000M --innodb_log_file_size=250M --innodb_log_buffer_size=250M --innodb_support_xa=0 --innodb_flush_log_at_trx_commit=0 --innodb_doublewrite=0 --max-allowed-packet=250M
    peaks:
      depends_on:
         - db
      image: r4yan2/peaks:slim
      volumes:
        - ./config:/etc/peaks
        - ./filestore:/var/peaks
        - ./pgp_dump:/tmp/pgp_dump
      environment:
        MYSQL_HOST: "db"
        MYSQL_PORT: 3306
        MYSQL_USER: "root"
        MYSQL_PASSWORD: "mysupersuperpassword"
      ports:
         - 11370:11370
         - 11371:11371
      command:
        - sh
        - -c
        - /srv/peaks/init.sh && svscan /srv/peaks/service

Volumes/Mount

• peaks_db is where the database will store the persistent data
• config is the path to the config folder, if an empty folder is provided, the init script will create a default config and membership file for you
• filestore will hold new key material
• pgp_dump is the path to the current dump, please note that references to these files will be used to retrieve key material when needed, so you shall not delete the files after setup

Environment

• MYSQL_HOST MYSQL_PORT MYSQL_USER MYSQL_PASSWORD may be changed as needed (just make sure MYSQL_ROOT_PASSWORD and MYSQL_PASSORD match)

Commands

• mysql command line is just an example to improve performances over the default parameters, if you are short on RAM it is possible to use just --innodb_support_xa=0 --innodb_flush_log_at_trx_commit=0 --innodb_doublewrite=0. However, the queries will possibly we slower.

The image contains a init.sh file that will take care of initialization. Just run docker-compose up -d, the script will:

Manual configuration

Database

Config and membership

Peaks will look for a configuration file peaks_config in one of the following locations:

• the peaks binary location
• /var/lib/peaks/peaks_config
• /etc/peaks/peaks_config

To generate a default configuration file

peaks config > peaks_config

Most of the default parameters will do just fine for most cases. The database configuration needs to be changed according to your system setup, otherwise peaks will hang or complain or both.

Use

The main peaks executable accept the following commands:

• config - will output a default configuration for peaks
• import - will import the pgp dump into the database
• build - proceed to create the ptree
• serve - serve the pgp infrastructure through the web interface
• recon - start reconing with other peers
• unpack - divide and analyze the stored certificates in the actual key material
• analyze - analyze the key material to find known vulnerabilities (WARNING: CPU/Memory/Disk intensive, for key security analysis only)
• blocklist - mark some keyID as blocked, eventually removing keys from DB

peaks -h will give the list of accepted commands and options

Initialization

You will need to have a collection of pgp dump that peaks will import.

peaks import --init <path_to_DB_initialization_file> --path <path_to_dump> --threads <N>

• init DB initialization file. A schema.sql might be found under the bin folder
• path folder keeping the .pgp files
• threads number of threads to use

Note: to reduce the operation time, database size and I/O stress on the target machine peaks will not import certificate in the database, just their metadata, so you should not remove them after the import procedure

Build the prefix tree

After succesfully importing the certificate you need to generate the metadata to reconcile with other keyservers

peaks build

Start up the server process

To be able to query peaks from the web interface (and to allow other keyserver to fetch key-material from you) run

peaks serve

At the beginning, no key will be searchable using the web interface. This because the key material needs to be indexed first. A daemon will slowly unpack the certificates Note if you don't want/need the web search you can skip this step, the key can be directly fetched using the keyID/fingerprint via command line tools

peks unpack

Reconcile

To start reconciling please setup the config file and the membership file accordingly. Then, just run

peaks recon

Blocklist

Sometimes it may be necessary for server administrator to block certain key. Just provide the list of key IDs to the blocklist command.

Note that the blocked keys will be completely wiped from the database and cannot be readded again

peaks blocklist ID1 ID2

Configuration options

Now will follow a list of the configuration options that could be modified from the main configuration file

Internal settings

These settings change the way metadata are organized or the behavior of reconciliation. It is better to leave them as default

Generic settings

These settings are generic and may be changed

Database settings

This settings needs to be changed according to your setup

File and folders settings

This settings might be changed according to your needs

Membership file

This file will host hostname and port of the keyserver that agree to reconcile with you.

Empty lines and lines commented via # are ignored Note that the agreement with another keyserver operator is necessary: if your keyserver does not appear in the membership file of the other server it will refuse the connection.

yourserver.example.net         11370   # Your full name <emailaddress for admin purposes>
keyserver.gingerbear.net       11370   # John P. Clizbe <John@Gingerbear.net>          
sks.keyservers.net             11370   # John P. Clizbe <John@Gingerbear.net>          
keyserver.rainydayz.org        11370   # Andy Ruddock <andy.ruddock@rainydayz.org>     
keyserver.computer42.org       11370   # H.-Dirk Schmitt <dirk@computer42.org>